credential

Overview ¶

Package credential remembers host passwords so that connecting does not mean typing one every time.

Passwords are kept in credentials.json in ~/.ohmyssh, alongside anything else ohmyssh keeps for this user — %USERPROFILE%\.ohmyssh on Windows, which is what os.UserHomeDir reports there. The file is encrypted with AES-256-GCM under a key derived from the local user, machine and OS. Be clear about what that buys: it keeps the passwords out of sight of anything that merely reads the file — a backup, a sync client, a stray `cat` — but the key is derivable by anyone who can already run code as this user, so it is not a defence against a compromised account. The file is written 0600 and the directory 0700, which Windows applies as the read-only attribute and nothing else: there the encryption is the whole of the protection.

A store copied to another machine will not decrypt; the passwords are simply not found and the caller falls back to prompting.